Security Audits May Miss Major Vulnerabilities as Third Quarter Hacks Reach $1.18 Billion

Crypto security firm Hacken has identified a significant gap between industry security practices and actual protection against theft and exploitation. According to Hacken's analysis, third-quarter hacking losses totaled $1.18 billion, yet 77% of these losses involved compromised suppliers, delayed security fixes, or systems that were not covered by the latest security reviews. The finding raises questions about the effectiveness of standard audit procedures and the false confidence they may provide to investors and users.

Hacken's research reveals that a substantial portion of cryptocurrency losses stem from vulnerabilities that exist outside the scope of formal security audits or involve third-party risks that audits typically do not address comprehensively. Compromised suppliers represent an indirect attack vector—when trusted service providers or integrations are infiltrated, even well-audited platforms can become targets. Delayed fixes suggest that known vulnerabilities were not remediated quickly enough, leaving exposure windows that attackers exploited. Systems operating outside the latest security reviews indicate that not all operational components of crypto platforms receive equal scrutiny during standard audit cycles.

The $1.18 billion figure for third-quarter losses underscores the scale of security breaches affecting the cryptocurrency sector. When three-quarters of those losses trace back to audit blind spots or supply chain compromises, the data suggests that current audit methodologies may provide incomplete protection. Investors and traders often view security audits as a primary indicator of platform safety, making this discrepancy particularly significant for risk assessment and due diligence practices.

For traders and investors, Hacken's findings carry practical implications regarding asset security and platform selection. A platform with a recent, high-profile security audit may still face substantial risks from third-party vulnerabilities, supplier compromises, or systems components not included in the audit scope. This means that audit reports alone should not be the sole basis for evaluating platform safety. Investors should consider whether audit reports explicitly cover third-party integrations, supplier security requirements, and the timeline for addressing identified vulnerabilities.

The emphasis on delayed fixes highlights another critical area for consideration. Even when vulnerabilities are discovered through audits or other means, the speed of remediation directly affects risk exposure. A platform that identifies a flaw but takes weeks or months to implement a fix leaves users vulnerable during that period. Traders holding significant assets on any platform should understand not only what audits have been performed but also how quickly the platform responds to emerging threats and reported vulnerabilities.

Supply chain compromises represent an increasingly sophisticated threat vector in cryptocurrency. Hacken's finding that 77% of third-quarter losses involved compromised suppliers indicates that attackers are targeting the infrastructure and third-party services upon which crypto platforms depend. This could include compromised API providers, wallet service integrators, or other backend systems. Traditional audits typically focus on a single platform's code and systems rather than the entire ecosystem of dependencies and suppliers.

For the cryptocurrency industry more broadly, Hacken's report suggests that security standards and audit practices may need to evolve to address these identified gaps. Comprehensive security reviews might need to expand beyond internal systems to encompass third-party risk management, supplier vetting, and the operational status of all systems in use. The current approach may have inadvertently created a false sense of security that does not reflect the actual threat landscape.

Traders and investors may want to monitor how security firms and cryptocurrency platforms respond to these findings. Platforms that proactively expand their audit scope to include third-party risks and supply chain vulnerabilities may differentiate themselves in the market. Additionally, increased scrutiny from users could drive platforms to improve their disclosure about audit coverage, vulnerability response timelines, and third-party risk management practices. Understanding these developments can inform ongoing decisions about which platforms to use and how to manage custody and storage of crypto assets.